The Cyber Security Experts Association of Ghana (CSEAG) has raised concerns about the potential exposure of government websites to cyberattacks, revealing that 22 out of 25 government websites it examined were built using PHP, a programming language affected by recently disclosed security vulnerabilities.
The association’s president, Abubakar Issaka, has urged government institutions, businesses and other organisations to urgently check their PHP installations and apply the necessary security updates to prevent possible attacks.
Speaking on the Asaase Breakfast Show on Friday, October 23, Mr Issaka said the vulnerabilities, disclosed on October 21, could expose affected systems to unauthorised access, data theft, malicious commands and service disruptions if left unaddressed.
“Out of over 25 websites, government websites we want to move, we realised that out of 25, only three were not using PHP,” he said.
He clarified, however, that the use of PHP alone does not make a website vulnerable, as the actual risk depends on the version installed and whether the relevant security patches have been applied.
PHP is widely used to power the back-end operations of websites and web applications, enabling them to process user submissions and interact with databases containing personal and other sensitive information.
Mr Issaka warned that attackers who exploit the identified vulnerabilities could compromise systems, access confidential records, disrupt online services or deploy ransomware to extort affected organisations.
Security fixes available, but action required
Mr Issaka said security updates had been made available by PHP developers, urging organisations running vulnerable versions to upgrade to secure, supported releases.
He stressed that the updates were free, although organisations might incur costs if they needed to hire web developers or system administrators to implement them.
“The update comes at no cost and it is free,” he said, advising website owners to contact their technical teams to verify their PHP versions and apply the appropriate security fixes.
He cautioned that the process would not happen automatically and required prompt action from those responsible for maintaining the websites.
The association’s president also disclosed that follow-up checks conducted on the morning of the interview showed that three key websites had been upgraded between the previous day and the morning of the broadcast.
He declined to identify the websites, citing confidentiality concerns, but said the changes indicated that some institutions had responded to the association’s advisory.
According to him, the association had communicated its findings to relevant security institutions and was continuing to monitor responses to the warning.
Delayed updates could expose sensitive data
Mr Issaka warned that organisations that fail to address vulnerabilities in their systems could become targets for cybercriminals seeking to exploit known security weaknesses.
He urged public institutions and private businesses to act swiftly, stressing that delays could expose them to data breaches, operational disruptions and financial losses.
“Make sure the abatement is done,” he said, cautioning organisations against leaving potentially vulnerable systems exposed.
He added that the security concern extended beyond Ghana, as organisations worldwide were responding to the disclosure of vulnerabilities in the widely used programming language.
The association’s warning highlights the importance of regular software updates, vulnerability assessments and effective cybersecurity management, particularly for institutions whose online platforms process sensitive citizen, customer and financial information.
Organisations have been advised to consult their web developers or system administrators to establish whether their PHP installations are affected and ensure that the appropriate security updates are applied.
